)]}'
{
  "commit": "d95ca9138026cbe40e0857d76a81a16d03230871",
  "tree": "d0003a1cfa2802a85ed2cab876bd8d0442294df4",
  "parents": [
    "ecf4ebf10054f70e51a0ce759b2ae91aa4febd1a"
  ],
  "author": {
    "name": "Filippo Valsorda",
    "email": "filippo@golang.org",
    "time": "Fri Jan 08 03:56:58 2021 +0100"
  },
  "committer": {
    "name": "Roland Shoemaker",
    "email": "roland@golang.org",
    "time": "Thu Jan 21 18:52:19 2021 +0000"
  },
  "message": "crypto/elliptic: fix P-224 field reduction\n\nThis patch fixes two independent bugs in p224Contract, the function that\nperforms the final complete reduction in the P-224 field. Incorrect\noutputs due to these bugs were observable from a high-level\nP224().ScalarMult() call.\n\nThe first bug was in the calculation of out3GT. That mask was supposed\nto be all ones if the third limb of the value is greater than the third\nlimb of P (out[3] \u003e 0xffff000). Instead, it was also set if they are\nequal. That meant that if the third limb was equal, the value was always\nconsidered greater than or equal to P, even when the three bottom limbs\nwere all zero. There is exactly one affected value, P - 1, which would\ntrigger the subtraction by P even if it\u0027s lower than P already.\n\nThe second bug was more easily hit, and is the one that caused the known\nhigh-level incorrect output: after the conditional subtraction by P, a\npotential underflow of the lowest limb was not handled. Any values that\ntrigger the subtraction by P (values between P and 2^224-1, and P - 1\ndue to the bug above) but have a zero lowest limb would produce invalid\noutputs. Those conditions apply to the intermediate representation\nbefore the subtraction, so they are hard to trace to precise inputs.\n\nThis patch also adds a test suite for the P-224 field arithmetic,\nincluding a custom fuzzer that automatically explores potential edge\ncases by combining limb values that have various meanings in the code.\ncontractMatchesBigInt in TestP224Contract finds the second bug in less\nthan a second without being tailored to it, and could eventually find\nthe first one too by combining 0, (1 \u003c\u003c 28) - 1, and the difference of\n(1 \u003c\u003c 28) and (1 \u003c\u003c 12).\n\nThe incorrect P224().ScalarMult() output was found by the\nelliptic-curve-differential-fuzzer project running on OSS-Fuzz and\nreported by Philippe Antoine (Catena cyber).\n\nFixes CVE-2021-3114\nFixes #43786\n\nChange-Id: I50176602d544de3da854270d66a293bcaca57ad7\nReviewed-on: https://go-review.googlesource.com/c/go/+/284779\nRun-TryBot: Roland Shoemaker \u003croland@golang.org\u003e\nTryBot-Result: Go Bot \u003cgobot@golang.org\u003e\nTrust: Ian Lance Taylor \u003ciant@golang.org\u003e\nTrust: Roland Shoemaker \u003croland@golang.org\u003e\nReviewed-by: Filippo Valsorda \u003cfilippo@golang.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2ea63f3f0c0577677464a6194670a3fc8df91791",
      "old_mode": 33188,
      "old_path": "src/crypto/elliptic/p224.go",
      "new_id": "8c76021464207f4f78a1bd0a7bc3d7d8e7bbb20e",
      "new_mode": 33188,
      "new_path": "src/crypto/elliptic/p224.go"
    },
    {
      "type": "modify",
      "old_id": "8b4fa0483b6a04bceb0164c0b64f6ee3a035f848",
      "old_mode": 33188,
      "old_path": "src/crypto/elliptic/p224_test.go",
      "new_id": "c3141b6ab4de0b00ec7382cff55b2d47b8ab1d0d",
      "new_mode": 33188,
      "new_path": "src/crypto/elliptic/p224_test.go"
    }
  ]
}